EUVD-2025-210317
GHSA-r7w2-7c95-6pj5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable SQL listener with low complexity, but Virtuoso typically authenticates SQL sessions so PR:L; only availability impacted.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
AnalysisAI
Denial of service in OpenLink Virtuoso Open Source Edition v7.2.11 allows remote attackers to crash the database engine by submitting crafted SQL statements that mishandle column predicate processing inside the sqlo_tb_col_preds query optimizer component. CVSS 7.5 reflects high availability impact with no authentication required, though no public exploit identified at time of analysis and the issue is tracked only as an upstream GitHub bug report.
Technical ContextAI
Virtuoso is a multi-model hybrid RDBMS from OpenLink Software combining relational SQL, RDF/SPARQL, and column store engines, commonly used as a triple store and SPARQL endpoint. The vulnerable sqlo_tb_col_preds routine sits inside the SQL optimizer (sqlo = SQL optimizer) and is responsible for evaluating column-level predicates while building a query plan for a table reference. Although the CWE is recorded as CWE-89 (Improper Neutralization of Special Elements in an SQL Command), the observable behavior - a process-killing crash from malformed SQL - is more characteristic of an unchecked-input or null-pointer/assertion failure in the optimizer than classic injection, so the CWE tag likely reflects the SQL-parsing surface rather than data exfiltration via injected queries.
RemediationAI
No vendor-released patch identified at time of analysis; the only public artifact is the upstream issue at https://github.com/openlink/virtuoso-opensource/issues/1226, so administrators should monitor that ticket and the openlink/virtuoso-opensource repository for a tagged release that fixes sqlo_tb_col_preds and upgrade as soon as one is published. Until a fix lands, compensating controls include placing the Virtuoso SQL listener (default TCP 1111) behind a firewall or VPN so only trusted clients can submit SQL, disabling anonymous/SPARQL-update access on the /sparql endpoint via the SPARQL_UPDATE role configuration (side effect: read-write SPARQL clients break), enforcing strong SQL_USER authentication and removing the default dba/dba credentials, and adding a supervisor or systemd auto-restart for the virtuoso-t process to limit downtime if a crash is triggered (side effect: masks repeated abuse, so pair with logging).
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-89 – SQL Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today